General

  • Target

    8841698b335573b0abe7875b85b653d6.exe

  • Size

    4.2MB

  • Sample

    241219-hpsn6strep

  • MD5

    8841698b335573b0abe7875b85b653d6

  • SHA1

    e74926dcb5b7e996d4f4961a763d2c4d8e8e24d0

  • SHA256

    490fc3ac1830a381350813ad614c258eb761886aad612879a592461edffd719b

  • SHA512

    2f8941aaf2724687e70f4c742ac2f3a2009df18776d8e182a3042eb33422463df109e1e666d8f8a66cd7f6312e86aa9dd4a127c5559e04cbd57a6da51077e037

  • SSDEEP

    98304:4Ha58BJIGJlaZO5+OFpubzo4p3BRTPb5Nk/B8R:47wbz97PDkJ

Malware Config

Extracted

Family

cryptbot

Targets

    • Target

      8841698b335573b0abe7875b85b653d6.exe

    • Size

      4.2MB

    • MD5

      8841698b335573b0abe7875b85b653d6

    • SHA1

      e74926dcb5b7e996d4f4961a763d2c4d8e8e24d0

    • SHA256

      490fc3ac1830a381350813ad614c258eb761886aad612879a592461edffd719b

    • SHA512

      2f8941aaf2724687e70f4c742ac2f3a2009df18776d8e182a3042eb33422463df109e1e666d8f8a66cd7f6312e86aa9dd4a127c5559e04cbd57a6da51077e037

    • SSDEEP

      98304:4Ha58BJIGJlaZO5+OFpubzo4p3BRTPb5Nk/B8R:47wbz97PDkJ

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks